why is devilfish-applicationaccount accessing mailbox?

Question

I am seeing a number of events under my Admin reports with "set-mailbox" and "new-mailbox" by a user id "******@namprd12.prod.outlook.com.   I have read that this is an account SharePoint uses behind the scenes?  Is this accurate, or do I have a bigger problem?

Answer 1

You might to want to ask your partner how they decided the account is compromised :) FYI, there are over 100 such "backend" applications that most O365 tenants have/use, you can get a list via Get-MsolServicePrincipal or the Azure AD portal.

Answer 2

Thanks, but if that is the case, why can't I find anything online about it and our O365 partner told me an account was compromised??

Answer 3

Hi Jacque,

Feel free to share with the above information when you have time.

Thanks,

Amanda

Answer 4

Hi Jacque,

To better understand the situation, could you please share with the following information?

1.       Where and how did you find the reports?

2.       Provide with a screenshot of the information. In order to protect your privacy, I have sent you a private message to collect it.

Thanks,

Amanda

Answer 5

It's a Microsoft app, installed server-side. We all have it, dont worry about it.